Website Permissions and Access | Grant Maad Dev Access Safely

Permissions and Access

Your GitHub and Cloudflare accounts belong to you from day one. Maad Dev has zero access until you invite us in to help with setup — and you can revoke that access yourself, anytime, without waiting on us.

Why we need access

During setup, our team needs to add code, configure settings, and connect your services — which requires temporary access. Think of it like handing a contractor a key to renovate your house, not signing the house over.

How to grant access (setup phase only)

Complete both systems below in one sitting, then let our team know — we'll configure everything else (auto-deploy and the content editor) in a single pass. You never need to touch any code or CLI tools.

1. GitHub

• Sign up with your Google email
• Create a Private repository
• Go to Settings → Collaborators → invite using the email [email protected]

  Personal GitHub accounts don't have a granular role picker (Read/Write/Admin) like Organization accounts do — but this kind of invite still can't delete the repository or transfer ownership, which covers everything setup requires

2. Cloudflare

• Sign up with the same Google email
• Go to Manage Account → Members → invite using the email [email protected]
• Choose only the "Workers Platform Admin" role, then click Create policy — covers all setup work without touching billing
• Avoid Billing or Super Administrator access — our team never needs to see your payment details
• Create an Account API Token at Manage Account → Account API tokens, scoped to Developer Platform → Pages: Edit, Token expiration set to No expiry
• Send the Account Id & Token value to our team through a secure channel as well

These tokens and secrets only grant what's needed for setup — nothing touches billing or any other part of your account, and you can recreate or revoke them yourself, anytime, without waiting on us.

After that, our team wires up auto-deploy (edit = the site updates itself) and gets your website online for you to see right away — no need to touch the content editor at this stage.

Our standing rule: grant only what's needed for the job, never full system access.

Connect the content editor (Studio) — do this later, once your site is online with a real domain

Before this step, the content editor isn't enabled at all — your website displays normally, the editor page just isn't reachable yet (secure by default, no extra configuration needed to keep it that way). Once your site is live and you have a real domain ready, come back and do this:

• Create a GitHub OAuth App at GitHub → Settings → Developer settings → OAuth Apps → New OAuth App
  • Homepage URL: your real domain
  • Authorization callback URL: https://your-domain/__nuxt_studio/auth/github
• Send the resulting Client ID and Client Secret to our team through a secure channel (not a public chat)
• Our team sets all 3 of these values together in one pass, then redeploys: STUDIO_GITHUB_CLIENT_ID, STUDIO_GITHUB_CLIENT_SECRET, and STUDIO_GITHUB_MODERATORS (set to your GitHub email) — all 3 must always be set together. Set only the first two and forget Moderators, and anyone with a GitHub account can open your content editor immediately.

You're always in control of these permissions

Not just when the work wraps up — for as long as your website is live, you can manage, change, or revoke any of these permissions yourself, anytime, without asking or waiting on our team: create a new API Token to replace the old one, change who has access to the content editor, or adjust member roles in Cloudflare. Every account is 100% yours — our team has no way to lock or restrict any of this ourselves.

Revoke our team's access anytime

Once your website is live and you've reviewed the work, we recommend removing our team's access right away — you can do this yourself, no permission needed:

• GitHub: Settings → Collaborators → click Remove next to our team's name
• Cloudflare: Manage Account → Members → click Remove

It takes under 2 minutes, and your website keeps running exactly the same, including auto-deploy — the API Token was stored in your own repository during setup and isn't tied to our ongoing access at all. Removing us doesn't interrupt anything.

Everything is auditable

Every change to your website is recorded in version history (Git history) — you can always see who changed what, when, and roll back to a previous version. Nothing happens invisibly.

Good security starts with clear access control — and you're always the one in control.